What is the pipeline processor responsible for redirecting the user to the login page if they do not have access to the page being loaded? In a Sitecore webforms solution, this is handled by the SecurityCheck pipeline processor, but what is it in a Sitecore MVC solution since the RenderLayout pipeline does not execute?

3 Answers 3


Like Mark Cassidy mentioned above, <mvc.requestBegin> would be a close "equivalent". I ran into a similar situation wanting non-authenticated users to be redirected to the <site loginPage="/login">. The only caveat I had was that I needed some custom logic to create virtual users based on their IP address (site to site VPN), so I decided to extend the Sitecore.Layout.RenderLayout.SecurityCheck like so:

namespace YourNamespace.Custom
  public class InternalSecurityCheck : SecurityCheck
    public virtual void Process(RequestBeginArgs args)
        Assert.ArgumentNotNull(args, "args");
        Profiler.StartOperation("Check security access to page.");

        if (!HasAccess() || Context.User.LocalName.ToLower().Equals("anonymous"))
            //logic for checking IP and creating virtual user if internal

        if (!HasAccess())
            var loginPage = GetLoginPage(Context.Site);
            if (loginPage.Length > 0)
                var urlString = new UrlString(loginPage);
                if (Settings.Authentication.SaveRawUrl)
                    urlString.Append("url", HttpUtility.UrlEncode(Context.RawUrl));

                var absolutePath = HttpContext.Current.Request.Url.AbsolutePath;
                if (!string.IsNullOrEmpty(absolutePath))
                    urlString["returnUrl"] = absolutePath;

                Tracer.Info("Redirecting to login page \"" + loginPage + "\".");

                WebUtil.Redirect(urlString.ToString(), false);
                Tracer.Info("Redirecting to error page as no login page was found.");
                WebUtil.RedirectToErrorPage("Login is required, but no valid login page has been specified for the site (" + Context.Site.Name + ").", false);


The above code should also preserve the return url if a page is bookmarked or session expires while visiting. I think the only remaining piece, after extending the SecurityCheck is binding it to the <mvc.requestBegin:

  <processor type="YourNamespace.Custom.InternalSecurityCheck, YourNamespace.Web" />

(https://community.sitecore.net/developers/f/8/t/2808 assisted me thru some of this). Hope this is helpful.

  • One thing to correct here is that the InternalSecurityCheck class should inherit from Sitecore.Mvc.Pipelines.Request.RequestBegin.RequestBeginProcessor not Sitecore.Pipelines.RenderLayout.SecurityCheck since this pipeline class is hooked in the <mvc.requestBegin> pipeline, rest of all remains the same.
    – Harsh Baid
    Commented Jun 8, 2017 at 21:32

The one that mimics it most closely, is the <mvc.requestBegin> pipeline. Essentially, MVC will break off and start processing here, where the traditional would have continued to call <renderLayout>

Also - since you're specifically asking about the SecurityCheck functionality that resides in <renderLayout>, be aware that some of this functionality has not made it correctly to the MVC sister pipelines at this point. Specifically the MVC SiteSecurityChecker does not respect requireLogin. If this is the root issue you're looking into, I have it registered as a bug with Sitecore Support - public reference 93728. They can provide you with a hotfix for it.

From Sitecore.MVC.config

    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.DisplayFatalErrors, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.IgnoreList, Sitecore.Kernel']" />
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.TransferRoutedRequest, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.ItemResolver, Sitecore.Kernel']" />
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.TransferControllerRequest, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.LayoutResolver, Sitecore.Kernel']" />
    <processor type="Sitecore.Mvc.Pipelines.HttpRequest.TransferMvcLayout, Sitecore.Mvc" patch:after="processor[@type='Sitecore.Pipelines.HttpRequest.LayoutResolver, Sitecore.Kernel']" />

Which then leads to

    <processor type="Sitecore.Mvc.Pipelines.Request.RequestBegin.SetupPageContext, Sitecore.Mvc"/>
    <processor type="Sitecore.Mvc.Pipelines.Request.RequestBegin.ExecuteFormHandler, Sitecore.Mvc"/>
  • 1
    What I'm trying to do is tie into the redirect user to login page if they are not authenticated functionality. I'd like to find the pipeline processor that is responsible for this functionality for an MVC solution. I can't seem to find SiteSecurityChecker. Which assembly does this class live in? Commented Oct 11, 2016 at 21:20
  • I'm also facing this issue, even though requirelogin is set to true the user is not redirected to login page. I tried to search with this public reference number on google but didn't find any links to KB.sitecore.net
    – Harsh Baid
    Commented Jun 8, 2017 at 17:23

When I traced this through for a recent project, I found that the ExecuteRequest (as part of the HttpRequestBegin pipeline) did the redirection on invalid credentials. This is the line in my Sitecore 8.1 Sitecore.config file.

<processor type="Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel"/>

I'm not sure if there's a specific MVC pipeline or if the above pipeline handles MVC execution/checking as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.